BestWebSoft vulnerabilities
We track 11 vulnerabilities in BestWebSoft products across 11 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on August 16, 2026.
Latest BestWebSoft vulnerabilities
- 7.2 High severity
Gallery by BestWebSoft – Customizable Image…: Improper Neutralization of Special Elements used in an SQL Command
The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of
- 7.2 High severity
SMTP by BestWebSoft: Unrestricted Upload of File with Dangerous Type
The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Admini
- 7.2 High severity
Gallery by BestWebSoft – Customizable Image…: Deserialization of Untrusted Data
The Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.7.3 via deserialization of untrusted input in the 'import_gallery_from_csv' fun
- 8.8 High severity
Contact Form to DB by BestWebSoft: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.
- 7.1 High severity
Limit Attempts by BestWebSoft: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestWebSoft Limit Attempts by BestWebSoft allows Reflected XSS.This issue affects Limit Attempts by BestWebSoft: from n/a through 1.2.9.
- 7.1 High severity
Contact Form With Captcha: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Contact Form With Captcha allows Reflected XSS.This issue affects Contact Form With Captcha: from n/a through 1.6.8.
- 8.8 High severity
Contact Form to DB by BestWebSoft – Messages…: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Databas
- 8.8 High severity
Post to CSV by BestWebSoft: Improper Neutralization of Formula Elements in a CSV File
Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.
- 9.8 Critical severity
Contact Form to DB by BestWebSoft – Messages…: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form
- 8.8 High severity
Gallery by BestWebSoft: Improper Neutralization of Special Elements used in an SQL Command
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://
- 8.8 High severity
User Role by BestWebSoft: Cross-Site Request Forgery
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.